{
  "id": "CB-M365-DEVICE-016",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-016",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-016.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-016.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-DEVICE-016",
    "title": "Block Microsoft Publisher",
    "finding": {
      "title": "Microsoft Publisher can still be launched",
      "description": "Publisher, retired from Microsoft 365 and with a large attack surface, still runs on devices where it is installed."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "microsoft-365-apps",
      "baseline-security-mode",
      "cloud-policy",
      "publisher",
      "attack-surface"
    ],
    "description": "The Baseline Security Mode setting **Block Microsoft Publisher** is turned on in the Microsoft\n365 admin center (Cloud Policy policy **Disable Publisher** set to **Enabled**). Publisher does\nnot start on any device that receives Microsoft 365 apps policies, and users see the message that\na security policy set by the organization prevents it.\n",
    "rationale": "Publisher files (.pub) are rarely used, poorly inspected by mail filters, and Publisher's parser\nhas a large attack surface. Microsoft stopped including Publisher in Microsoft 365 in October\n2026, so it no longer receives new features and is on its way out of support. Blocking it removes\nan attack vector that almost nobody needs.\n",
    "impact": "Users can no longer open or edit .pub files. Convert the remaining publications to Word or PDF\n(or move layout work to another tool) before turning the setting on. Devices running older\nMicrosoft 365 apps builds or perpetual Office versions that still ship Publisher are the ones that\nmatter: the block only applies to apps that receive Cloud Policy settings.\n",
    "notes": "Microsoft announced that Publisher is no longer included in Microsoft 365 from October 2026. Keep\nthe control until the inventory shows no Publisher installation left; it can then be retired.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a\n   Global Reader.\n2. Browse to **Settings** > **Org settings** > **Security & privacy** > **Baseline security\n   mode**.\n3. Check that **Block Microsoft Publisher** is turned on.\n4. In the Office Cloud Policy service (https://config.office.com), check that no higher-priority\n   policy configuration sets **Disable Publisher** to **Disabled**.\n5. Fail if the setting is off or overridden for a group of users.\n"
    },
    "remediation": {
      "manual": "1. Find remaining Publisher users with the setting's impact report, and convert their files.\n2. In **Settings** > **Org settings** > **Security & privacy** > **Baseline security mode**,\n   turn on **Block Microsoft Publisher**. Role: Office Apps Administrator.\n3. Alternative: set **Disable Publisher** to **Enabled** in an Office Cloud Policy configuration\n   targeting all users. No PowerShell cmdlet exists.\n4. Remove Publisher from deployment configurations (Office Deployment Tool `ExcludeApp\n   ID=\"Publisher\"`) for older builds.\n",
      "rollback": "Turn the setting off, or set **Disable Publisher** back to not configured.\n"
    },
    "references": [
      {
        "title": "Block Microsoft Publisher",
        "url": "https://learn.microsoft.com/microsoft-365/baseline-security-mode/block-microsoft-publisher",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Baseline security mode settings",
        "url": "https://learn.microsoft.com/microsoft-365/baseline-security-mode/baseline-security-mode-settings",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-10",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1203"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-DEVICE-015",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}